Occulta 2.0 INTRODUCTION CARDS Can't meet someone yet? Send them an introduction card over any channel and they can write to you first. They stay marked Not verified until you meet in person, and the exchange then checks they're who you were writing to. Needs iOS 26 on both phones. SEE HOW EACH MESSAGE IS PROTECTED Before you send, Occulta shows whether the message will be Single View with forward secrecy, use a temporary key, or use a long-term key, and what that means for you. STRONGER PROTECTION • One-time keys are now refilled before they run out, so forward secrecy holds through long conversations. • Data on your phone is sealed under keys more tightly bound to the Secure Enclave. • Phones that update to iOS 26 are upgraded to post-quantum protection automatically. LARGE VIDEOS AND FILES Very large videos and files now send and open without Occulta running out of memory, once the other person has updated. Occulta also appears in the share sheet for videos in Photos, up to 100 MB. FIXES • Group messages can now carry videos and other attachments. • Group messages are checked more strictly when opened. • Opening an old response file no longer shows a false "Verification failed" warning. • Received files you never opened are cleaned up. • Erase All Data also clears temporary sharing data.

• Fixed trustees sometimes never confirming their backup recovery piece

Vault restore, rebuilt - Restore from Backup is now in the Vault tab's + menu. It lists the steps for setting up a new phone in order. - A restore now runs in one step. Choose your backup file, and if enough of your trusted contacts have sent back their recovery pieces, your entries return right away. If not enough have arrived yet, nothing is kept. Open the file again once more pieces come in. - A restore either finishes completely or changes nothing. - One damaged recovery piece can no longer block a restore. - Pieces held by people you've removed from your backup no longer count toward a restore. A vault that locks when it should - The inactivity lock now counts only what you do in the vault. Using the rest of the app no longer keeps it open. - Typing an entry keeps the vault unlocked, so a long seed phrase won't be cut off halfway through. - If the vault locks while you're writing an entry or setting up a backup, the screen clears and closes instead of leaving your secret on display. - Exporting a backup or opening a backup file asks for Face ID when the vault is locked, instead of failing silently. Fewer traces on your device - Files you open in Occulta from other apps no longer stay in the app's folder afterwards. Copies left behind by earlier versions are removed too. - Erase All Data now also removes backup and restore files. - Backup contents are wiped from memory as soon as an export or restore finishes. - Secure Mode keeps things more strictly separate throughout the vault. - Security hardening across the vault and recovery code, including constant-time secret-sharing math.

- Fixed a bug where some older Vault entries could be silently excluded from backups - Vault recovery is now faster and more reliable, especially when a trustee has set up a new device - Fixed a bug where photos and files shared through the share sheet could retain hidden EXIF and GPS metadata that should have been stripped - Strengthened Secure Mode so contact and Vault data no longer leak information through ciphertext size alone - General performance and reliability improvements throughout Vault and Secure Mode

Stronger sender verification. Messages now carry a signature proving who sent them, checked against a key that never leaves your device's Secure Enclave. Occulta verifies it on every message it opens. Some contacts may need to update. Versions before 1.10.0 don't add this signature. If a message won't open and Occulta suggests asking the sender to update, that's why — once they're on the latest version, their messages open normally. Also fixed: an issue that could leave previously created groups unreadable — affected groups are cleared when you update and can be recreated — and a problem where contacts could be incorrectly shown as needing an app update.

This update focuses on reliability and polish across the app. • Secure Mode: improved reliability and strengthened protection in how duress mode behaves under pressure. • Vault: opening shard management for a vault entry is now dramatically faster — what used to take several seconds now feels instant. • Settings: reorganized into clear, labeled sections, with a restored path back to Vault Recovery and a confirmation step before erasing all data, so a single stray tap can no longer trigger it. • General bug fixes and stability improvements.

Your drafts stick around, your contacts are easier to manage, and your encryption status is always visible. - Drafts that don't disappear. Start composing, get interrupted, come back later — your message and any attachments will be right where you left them. Contact's marked private, sensitive don't have drafts for security reasons. - Trust Check. Mark a contact as safe or private in one tap, right from their profile. - See your encryption at a glance. A new badge on the compose screen shows whether a conversation is using Forward Secrecy or standard encryption. - A clearer start. A quick new screen walks you through your Vault before you dive in. - Progress bars for encrypting and importing media — no more wondering if it's still working. - Smarter recovery. If something stalls, retry right in the app instead of hitting a dead end. - Plus a round of security and performance improvements under the hood — including a fix for a brief freeze that could happen when marking a contact private.

Fix: - Removing a big delay on app launch for users with multiple groups.

v1.9.1 - Group messages now support full multi-layer duress protection, matching individual contacts - Vault recovery shards can now be distributed through group messages - Fixed an issue affecting message delivery for some contacts - General reliability improvements

What's New Groups, and a new way to catch impersonation before it costs you anything. • Encrypted groups — Create a group of up to 32 verified contacts and encrypt a file for all of them at once, then send it however you like. Same proximity-verified keys, same zero-server model, now for more than one person. • Challenge a suspicious request — Got a call or message asking for money or personal details, supposedly from someone you've verified? Ask them directly from their contact card. They confirm with Face ID or Touch ID on their own device — so it's their key answering, not whoever's actually on the other end. • Tighter privacy on your contacts list — Removed a timestamp that revealed when you last exchanged keys with someone. Fingerprint previews are now opt-in instead of on by default. • Security and stability improvements under the hood.

Fix: - Opening bundles containing files caused a crash.

New feature: - Thread style message: Compose messages in story like fashion. Photos, Videos, Docs, Text can now be sequentially added to a message to tell a story. Fixes: - Temporary files used to hold data displayed in messages are now encrypted. Leaving behind them is no longer a concern because nobody can read them. - Eliminates file bloating due to 3 layer encoding. Final encrypted file would be 2.3x the size of the original files.

New key exchange flow with animation. App switcher security blanket only activates when secure mode is on.

New Feature: Secure Mode Secure Mode is a coercion-resistant deniability layer for Occulta. It lets you maintain a convincing decoy view of the app — with a different set of visible contacts — that can be shown under duress without revealing that any contacts are hidden. How it works Secure Mode is built on two PINs: Normal PIN — unlocks the real view. All contacts are visible. Duress PIN — unlocks a decoy view. Contacts you marked as sensitive are hidden. The app looks and functions identically to the real view. Both PINs are device-bound via the Secure Enclave: the verifier blobs stored on disk are useless without the physical device. What "sensitive" means During setup you classify each contact as safe (visible in both views) or sensitive (visible only when you enter the normal PIN). Sensitive contacts are hidden at the UI layer — they remain in the encrypted database but are inaccessible in the decoy view. Their visibility state is stored encrypted per contact. PIN entry A single 4-digit keypad handles both PINs. The app scans all configured verifiers on every entry and routes to the correct view without the user choosing a mode. Under coercion you simply enter the duress PIN as if it were your only PIN. Forensic neutrality The implementation is designed so that a forensic examiner cannot distinguish a device with Secure Mode active from one that has never used it: Deactivation Deactivation mirrors activation: a new staged key is created, sensitive contacts are restored from the layer store back into the database, all data is re-encrypted, and the duress verifier is removed. After deactivation the app returns to PIN-only mode with all contacts visible. Coercion gate Under coercion, while in the decoy view, you can lower the PIN overlay gate via Settings. The app then opens directly to the decoy view on the next launch without showing a PIN prompt — indistinguishable to an observer from a device with no PIN configured. All depth filtering remains active; hidden contacts stay hidden. You can re-enable the PIN gate at any time. If the coercer re-enables the gate with a PIN of their own, the system silently creates a new layer for their PIN so the toggle always flips on — no observable difference from a genuine setup. Multi-layer support The architecture supports up to 32 nested duress layers. Each layer has its own duress PIN and its own set of contacts visible within it. Cold-start routing aliases mean entering any configured PIN from a fresh launch goes directly to the correct depth without stepping through intermediate layers. Share Extension The share index — the list of contacts available when sharing from other apps — is filtered to match the current security depth. Sensitive contacts are excluded from the share sheet in the decoy view.

New feature: Vault Backup You can recover the contents of you vault, in case you get a new device, by setting up backup. This includes 2 steps: 1. Setup trustees, custodians, who will hold pieces of your vault backup encryption key, 2. Store backup file. The pieces (shards) are derived by the Shamir Secret Sharing algorithm. You can configure how many shards exist and how many are needed to reconstruct the original key. Only trustees that are ML-KEM holders can be custodians.

- Secure Vault holding encrypted seed phrases, secure notes, API keys, anything that has to stay encrypted. Protected by Secure Enclave.

- New design for contacts. - 30 second timer during key exchange.

- Share extension: Allow users select files(photos, videos, documents), one or multiple, to be encrypted for a contact. It is useful because users don't have to go to the app to send files anymore. Just browse your Photo Library or Files, select file(s) and choose Occulta on the share sheet. Pick a contact that you want to encrypt the files for and then choose a transport channel. - Verify identity: Send a control message to a contact to verify an action (money request, meeting, etc). When an account gets hijacked, a fraudulent request could come in. This is a means to verify identity and the request.

Fixes: - New encrypt method using Post Quantum Protection - Clearing keys out of Secure Enclave after message decryption -> Can only open messages once.

Protection, ML-KEM1024, from Quantum Computing threats.

New: - Forward secrecy - encrypting messages with an ephemeral key to ensure each message is encrypted with a different key to prevent an attacker from viewing all messages encrypted with the same key. Fixes: - Files can now be added to a message.

New feature: - Compose a message using different types of content. You can combine messages, photos, videos and links into one message to be encrypted.

Bug fixes: - Fix for improper encrypted file reading preventing users from seeing encrypted messages.